dotProject Unspecified Data Handling Client-Side Cross Site Scripting Vulnerability


Description   A vulnerability has been identified in dotProject, which could be exploited by attackers to execute arbitrary scripting code. This issue is caused by unspecified input validation errors when processing user-supplied data, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.
     
Vulnerable Products   Vulnerable Software:
dotProject versions prior to 2.1 RC2
     
Solution   Upgrade to dotProject version 2.1 RC2 : http://sourceforge.net/projects/dotproject/
     
CVE   CVE-2007-3226
     
References   http://sourceforge.net/forum/forum.php?forum_id=697803
http://jvn.jp/jp/JVN%2363602912/index.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2007-06-15 

 Target Type 
Client 

 Possible exploit 
Local & Remote